Crate khive_gate 

khive-gate — pluggable authorization gate for verb dispatch.

The runtime consults a Gate impl before dispatching each verb. The default AllowAllGate is permissive (suitable for personal/local deployments). For production policy enforcement, plug a Rego-backed or capability-witness-backed impl into RuntimeConfig.gate.

Quick start

use std::sync::Arc;
use khive_gate::{AllowAllGate, Gate, GateRef, GateRequest, ActorRef};
use khive_types::Namespace;
use serde_json::json;

let gate: GateRef = Arc::new(AllowAllGate);
let req = GateRequest::new(
    ActorRef::anonymous(),
    Namespace::default_ns(),
    "search",
    json!({"query": "LoRA"}),
);
assert!(gate.check(&req).unwrap().is_allow());

Structs

ActorRef

Caller identity. kind distinguishes user vs agent vs lambda etc.

AllowAllGate

Permissive gate — every request is allowed with no obligations.

AuditEvent

Structured audit record emitted once per gate consultation (ADR-033).

GateContext

Per-request context — session, timing, transport source.

GateRequest

What the gate sees on every verb invocation.

Enums

AuditDecision

The outcome field of an AuditEvent, serialised as "allow" / "deny".

GateDecision

GateError

Obligation

Side-effects a policy may attach to an Allow decision.

Traits

Gate

Authorization gate consulted before each verb dispatch.

Type Aliases

GateRef

Shareable handle to a Gate impl.